Categories: Trojan

What is “TrojanDownloader:O97M/EncDoc.CN!MTB”?

The TrojanDownloader:O97M/EncDoc.CN!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:O97M/EncDoc.CN!MTB virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
At least one process apparently crashed during execution
Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Enumerates running processes
Reads data out of its own binary image
Drops a binary and executes it
Authenticode signature is invalid
Created a process from a suspicious location

How to determine TrojanDownloader:O97M/EncDoc.CN!MTB?


File Info:
name: 720D0F1CAFD301BF2E65.mlwpath: /opt/CAPEv2/storage/binaries/3e6645db8acd3ba810f7939f7253a0bd8373061d39fbd23699744faf8016c0c3crc32: 465F0AE8md5: 720d0f1cafd301bf2e65637410d7b2fbsha1: f003bbc63141838a9162be7cd295e3be65b4d486sha256: 3e6645db8acd3ba810f7939f7253a0bd8373061d39fbd23699744faf8016c0c3sha512: 867ec7280293eec76729928952989354b2f8ce43864bd5b4387072a268a52ab57ebe1dab408dba16128b5b32a4cd20dcec901afda78e0c3c50f70881f9d79e48ssdeep: 12288:z5393whFOBbkpJ+2PQf7ZanlQ0YZLccaMlEsVNFnmGK4Rzw:z53uhF7p8/f7mELn/VNxmp4pwtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T15CD40101BBDA5CFAC58336700B217F765AFAF22D1B1406C7A7983A16BE322D195391C7sha3_384: f76c8819b1a0b90e3c37c12b3e4628456998dd306dfdd23c8ebeb64b94078b7a95bcb861b5cc975b41fdcd5a28fec5beep_bytes: 558bec6aff6880fa410068f0c4410064timestamp: 2016-04-02 22:14:34
Version Info:
CompanyName: www.sordum.orgLegalCopyright: Copyright © 2015-2021 www.sordum.org All Rights Reserved.Comments: dfControl v2.0FileVersion: 2.0.0.0OriginalFilename: dfControl.exeFileDescription: dfControl v2.0ProductVersion: 2.0.0.0Created: 7z SFX Constructor v4.5.0.0 (http://usbtor.ru/viewtopic.php?t=798)Builder: User 13:20:39 09/10/2021Translation: 0x0000 0x04b0

TrojanDownloader:O97M/EncDoc.CN!MTB also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Trone.a!c
MicroWorld-eScan	Application.Hacktool.AUI
FireEye	Generic.mg.720d0f1cafd301bf
CAT-QuickHeal	Trojan.Agent
ALYac	Application.Hacktool.AUI
Cylance	Unsafe
Sangfor	Trojan.Win32.Trone.oo
K7AntiVirus	Trojan ( 700000111 )
BitDefender	Application.Hacktool.AUI
K7GW	Trojan ( 700000111 )
Cyren	W32/Trojan.OJWS-2267
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/RiskWare.DefenderControl.C
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Malware.Drivepack-9884589-1
Kaspersky	Trojan-Downloader.Win32.Trone.oo
Alibaba	TrojanDownloader:Win32/DefenderControl.c8172b4e
NANO-Antivirus	Riskware.Win32.DefenderDisabler.jklzpd
Rising	Downloader.Trone!8.120F0 (CLOUD)
Emsisoft	Application.Hacktool.AUI (B)
Comodo	ApplicUnwnt@#3fngi406ph0tx
TrendMicro	PUA.Win32.DEFCTRL.C
McAfee-GW-Edition	BehavesLike.Win32.PUP.hc
Sophos	Generic PUA PA (PUA)
SentinelOne	Static AI – Malicious SFX
GData	Application.Hacktool.AUI
Jiangmin	Trojan/CoinMiner.ab.a
Avira	TR/Agent.zek
Antiy-AVL	Trojan/Generic.ASBOL.C6A4
Arcabit	Application.Hacktool.AUI
ZoneAlarm	Trojan-Downloader.Win32.Trone.oo
Microsoft	TrojanDownloader:O97M/EncDoc.CN!MTB
Cynet	Malicious (score: 99)
McAfee	Artemis!720D0F1CAFD3
MAX	malware (ai score=84)
VBA32	TrojanDownloader.Trone
Malwarebytes	Malware.AI.619574118
TrendMicro-HouseCall	PUA.Win32.DEFCTRL.C
Tencent	Win32.Trojan-downloader.Trone.Adkn
Fortinet	Riskware/DefenderTool
AVG	Win32:Malware-gen